Winword.exe in memory for no apparent reason

[Camford]

This has happened maybe 2 or 3 times before and it just happened again 2
minutes ago. There was no apparent action taken to open MSword, however, the
file WINWORD.EXE is present in memory shown by the task manager. I only
switched on my computer 20 minutes ago and didn't open word. I'm just
wondering how it got into memory.

AV scan negative.

Thanks for all your replies in advance.

Camford

 

[Englander]

This has happened maybe 2 or 3 times before and it just happened again 2
minutes ago. There was no apparent action taken to open MSword, however, the
file WINWORD.EXE is present in memory shown by the task manager. I only
switched on my computer 20 minutes ago and didn't open word. I'm just
wondering how it got into memory.

have a scan through your registry find/search for winword.exe and see if
it appears in any of the run/start keys that might be it. Autostart with
windows.

 

[Camford]

Went through msconfig as well as registry with no luck. No suspeicious keys
or values identified.

Camford.

 

[Bill Sanderson]

Some versions of some email clients--Outlook? Default to having Word as the
editor for new messages. Check in tools, options.

Otherwise, another good reassurance tool is Microsofts MBSA security
analyzer, just rev'ed, and available here:

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/tools/mbsahome.asp

 

[Camford]

I'm going to blame it on Outlook or OE for that matter. It looks like it's
running as a service for one reason or another.

Another thing I forgot to mention is that this WINWORD.EXE doesn't have a
interface. It occupies some 30MB of memory and that's it.

Camford

 

[Laura Fredericks]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This has happened maybe 2 or 3 times before and it
just happened again 2 minutes ago. There was no
apparent action taken to open MSword, however, the
file WINWORD.EXE is present in memory shown by the
task manager. I only switched on my computer 20
minutes ago and didn't open word. I'm just wondering
how it got into memory.

Doesn't Microsoft Office add itself to the STARTUP
group by default?

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2
Comment: http://www.queenofcyberspace.com/laura_fredericks.asc

iQA/AwUBQA14J6RseRzHUwOaEQIErACdFtn6BIzy/+l2z2qqIRYTQeDjEUwAoMo8
racG0JFwce9ODNhvHp7FCirZ
=ITaT
-----END PGP SIGNATURE-----

--
Laura Fredericks
PGP key ID - DH/DSS 2048/1024: 0xC753039A

http://www.queenofcyberspace.com/usenet/

Remove CLOTHES to reply.

 

[Chris Bee]

On Tue, 20 Jan 2004 18:49:40 GMT,"Laura Fredericks" posted ...

Doesn't Microsoft Office add itself to the STARTUP
group by default?

Yes it does. Camford needs to remove the Office shortcut from:
"C:\Documents and Settings\All Users\Start Menu\Programs\Startup"

 

[Nick FitzGerald]

Doesn't Microsoft Office add itself to the STARTUP
group by default?

Not really...

A "normal" Office install will add a shortcut _called_ "Microsoft Office"
to your normal startup items, _BUT_ it is a shortcut to "osa.exe" (Office
Startup Assistant" ???) or "osa<version>.exe", depending on your version
of Office.

_That_ has nothing specifically to do with "ghost" instances of WinWord.exe
showing up in the task list.

 

[Nick FitzGerald]

Yes it does. ...

Wrong. See my response to Laura for details...

... Camford needs to remove the Office shortcut from:
"C:\Documents and Settings\All Users\Start Menu\Programs\Startup"

Not at all. Camford may decide to do that (you don't really need the
Office "quick start" gizmo using memory, but it's not an particularly
onerous load either, is it?).

Anyway, Camford is welcome to disable OSA, but it won't prevent the
"ghost" instances of WinWord.exe. Disabling the WordMail option in
Outlook _should_ remove this "ghost" (though there are reports of
difficulties in making it really go away, especially in later
versions of Office).

 

[Robert Moir]

This has happened maybe 2 or 3 times before and it just happened
again 2 minutes ago. There was no apparent action taken to open
MSword, however, the file WINWORD.EXE is present in memory shown by
the task manager. I only switched on my computer 20 minutes ago and
didn't open word. I'm just wondering how it got into memory.

AV scan negative.

Thanks for all your replies in advance.

If you have Outlook (not outlook express) this is the culprit - look under
tools -- options -- mail format.

Whoever dreamed this up at Microsoft needs to have something unpleasent
happen to them over and over again until they stop getting ideas like that
one. *sigh*

Hope that helps!

--
--
Rob Moir, Microsoft MVP for servers & security
Website - http://www.robertmoir.co.uk
Virtual PC 2004 FAQ - http://www.robertmoir.co.uk/win/VirtualPC2004FAQ.html

Kazaa - Software update services for your Viruses and Spyware.